GitHub Advisoryadvisory · Packagist

GHSA-847x-x4jg-6gf4 croogo Host header injection

MEDIUM Published 2025-04-21 Modified 2025-04-23 Official page ↗
Aliases
CVE-2024-29643
Ecosystem
Packagist
Packages
croogo/croogo
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-444, CWE-74
Reviewed
2025-04-21

Affected packages

• Packagist croogo/croogo: <= 3.0.2 (no fix yet)

Description

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

Related

Alias · CVE (1)

  • CVE-2024-29643 An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. vulnerability

Weakness · CWE (2)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References